Access Control & Biometrics

Mobile-first with card fallback is the right answer for new corporate deployments in 2026/2027. Mobile credentials (HID Mobile Access, Avigilon Alta Mobile, Verkada Access mobile, Apple Wallet for Access) give better UX (no card to lose / forget), instant issuance and revocation, native two-factor with the phone's own biometric, and a clean audit trail of issuance. Keep MIFARE DESFire EV3 cards as the fallback for non-smartphone users, contractor / visitor short-term issuance, and as the backup credential when phone batteries die. The combination is materially better than card-only and avoids the operational tax of card-printing operations. Don't go mobile-only for at least the first 2-3 years, fallback cards prevent lockouts and support staff who don't want a work app on their personal phone.

On-prem (Lenel S2 OnGuard / NetBox, Honeywell Pro-Watch, Genetec Synergis, Gallagher Command Centre) for banks, government, large hospitals, multi-site enterprise with deep CCTV / intrusion / fire integration needs, and any premises with strict data residency or audit requirements. Cloud-managed (Avigilon Alta, Verkada Access, Brivo, Genea, Kisi) for modern offices, distributed multi-site customers, mid-market enterprises wanting mobile-first UX, and any customer for whom on-prem operational discipline is a stretch. Cloud-managed also wins for retrofit scenarios where running new wired controllers is expensive, particularly with Salto KS or Aperio wireless extensions. Hybrid (on-prem controllers + cloud-managed UI like Genea on Mercury) is increasingly attractive for customers wanting on-prem reliability with cloud admin convenience.

Yes for general UAE commercial, hospitality, retail, SMB and time-and-attendance customers, ZKTeco appears on regulator approved lists for specific models, has the broadest UAE channel and most aggressive pricing, and is the de-facto choice for cost-led time-and-attendance deployments. The same caveats apply as Hikvision / Dahua: at the model level, the SKU you're specifying must be on the current SIRA / Civil Defence approved list (not just the brand); and banks, multinational corporates with global procurement policies, NDAA-compliance-required customers, and certain regulated sectors should evaluate against their procurement policy. Cybersecurity firmware maturity is materially behind premium Western tier (HID, Suprema, Idemia), patch cadence and supply-chain trust deserve scrutiny in regulated verticals. For unrestricted commercial buyers, ZKTeco remains cost-effective; for restricted buyers, default to Suprema, HID Lumidigm, Idemia or Anviz.

MIFARE DESFire EV3 cards as the foundation, plus mobile credentials (HID Mobile Access or the cloud platform's native mobile credential) layered on top. Avoid 125 kHz proximity (trivially cloneable), MIFARE Classic 1K/4K (Crypto-1 broken since 2008), and legacy iCLASS standard (older keysets vulnerable). Specify multi-tech readers that can read DESFire + mobile + (optionally) biometric, that gives you a smooth migration path as mobile adoption grows. For high-security zones (server rooms, vaults, narcotics cabinets), add a second factor, card + biometric or mobile + PIN. For visitors, QR code or one-time PIN issued through your visitor management platform. Don't specify Emirates ID for general commercial access, it's permitted only for specific licensed integrations (government, airport, port, banking).

OSDP v2 for any new install, Wiegand only for legacy compatibility with controllers you're not replacing. OSDP (Open Supervised Device Protocol) v2 is bidirectional, encrypted (AES-128), supervised (detects tampering and cable cuts), and supports modern features like over-the-wire reader configuration and biometric template transfer. Wiegand is unencrypted, one-way, and has been demonstrated cloneable for years (the 'ESPKey' attack lets an attacker capture and replay credentials with sub-AED 200 of hardware). All major access vendors support OSDP v2; the only reason to use Wiegand on a new install is integration with a legacy controller, and that's a sign the controller needs replacing too. Cabling difference is minimal (Wiegand uses 5-7 conductors, OSDP uses 4 conductors over twisted-pair), so the upgrade is cheap during cable design.

Every egress door must allow free egress without presenting a credential, magnetic locks must release on power loss or fire alarm (fail-safe), strike locks may be fail-secure or fail-safe depending on door function, and egress hardware (push bar, breakglass, request-to-exit) must be installed on the egress route. Push bars / panic hardware are mandatory on most occupant-load egress doors. Breakglass emergency releases are required adjacent to magnetic-lock egress doors (once broken, must be replaced). Fire alarm interlock is hard-required, magnetic locks on egress paths must release on fire alarm activation, hard-wired with fire-rated cabling and certified during commissioning. Get any of this wrong and the building doesn't get Civil Defence sign-off, no occupancy permit, no business operating from the premises. Always engage a Civil Defence-certified installer and treat fire-integration as a pass/fail commissioning gate, not a phase-2 task.

Yes, at deployment, not as a phase-2 nice-to-have. Without HR integration, joiners-movers-leavers (JML) is a manual process that fails: leavers retain working credentials for weeks (sometimes months), role changes don't propagate to access permissions, and audit trails don't tie back to HR records. Modern enterprise platforms (Lenel S2, Honeywell Pro-Watch, Genetec, Avigilon Alta, Verkada) all support SCIM or API integration with SAP SuccessFactors, Workday, Oracle HCM, Microsoft Dynamics, BambooHR and others, or via an IDM broker (Okta, Microsoft Entra). Once configured, terminations in HR automatically deactivate credentials within minutes, role changes update access permissions, and audit trails reconcile with HR. Skipping HR integration at deployment to 'do it later' almost always becomes 'do it never', and the security and compliance risk compounds for years.

Probably not, unless you have an explicit licensed use case and have done legal review. Face recognition for general commercial deployment is regulator-restricted in UAE (similar to CCTV facial recognition), typically permitted for time-and-attendance with explicit consent, premises with specific licensed use cases, or paired with another credential as a verification factor (not as the sole identifier). What customers usually actually want is touchless access, which is well-served by mobile credentials (NFC tap with phone) and card readers with auto-presence detection, both of which avoid the regulator scrutiny. For sensitive-zone access, multi-factor (card + biometric or mobile + PIN) is generally a better answer than face-as-sole-credential. If you do specify face recognition for time-and-attendance, ensure: explicit staff consent and opt-out path, template-only storage (never raw images), in-country data residency, encryption at rest, and clear retention/deletion policies. Always involve legal review before specifying.

Plan an 8-12 year refresh cycle for controllers, 5-8 years for readers, and 3-5 years for credentials in active use (cards wear; mobile credentials are software so they're refreshed via OS updates). Controllers have long support lifecycles, Mercury Security LP-class controllers from 2015 are still supported by all major platforms, but modern controllers (LP4502, LP1502, EVO Series) support OSDP v2, encrypted communications, and modern integration features that older units don't. Readers should refresh whenever the credential strategy changes (e.g., adding mobile credentials means multi-tech readers), or when 125 kHz prox / MIFARE Classic / Wiegand-only readers need replacement for security reasons. Software platforms typically maintain backward compatibility for 5-7 years on major versions; budget the per-door / per-cardholder Care or maintenance subscription as opex, not as periodic forklift replacement. The bigger cycle to plan for is the 'credential migration' cycle, every 7-10 years you'll move to a new credential family, and that's the right moment to refresh the readers and possibly the controllers.